SSL certificates
Updated July 2026 · 1 min read
Every custom domain on TagVolt gets an SSL certificate issued and renewed automatically — there is nothing to buy, upload or configure.
How it works
When you connect a custom domain, TagVolt handles the certificate end to end:
- You add the domain in the app and create the CNAME record at your DNS provider.
- Once DNS resolves, TagVolt requests a certificate for your subdomain and installs it.
- The domain switches to Active and your container serves over HTTPS.
Renewal is automatic too: certificates are replaced before they expire, with nothing for you to do.
What you never have to do
- Buy a certificate or generate signing requests.
- Upload certificate files or configure a server.
- Track expiry dates — renewals just happen.
Why issuance waits for DNS
A certificate can only be issued for a domain that actually points at TagVolt. That's why the status stays Pending until your CNAME record resolves — issuance starts the moment it does. Creating the record at common providers is covered in DNS records setup.
Pending simply means waiting. Usually it's DNS propagation — minutes in most cases, up to 48 hours at worst. There is nothing to approve or install on your side.
On Cloudflare, the orange Proxied setting can block issuance — the record must be DNS only (grey cloud). If Pending won't clear after a few hours, see Domain stuck on Pending.
After it's issued
Once the domain shows Active, your container is live over HTTPS on your subdomain. Run the quick checks in Verify your domain to confirm it from the browser's side.